# Issue: user changed google account and can't connect thru his profile **URL:** \ **Category:** Support\ **Created:** [2015年十月28日 17:36 UTC](https://meta.discourse.org/t/issue-user-changed-google-account-and-cant-connect-thru-his-profile/35028 "2015-10-28T17:36:34Z")\ **Posts on this page:** 9\ **Page:** 2
**Author:** ![david](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/david/32/157490_2.png) [@david](https://meta.discourse.org/u/david)\ **Post date:** [2019年三月1日 17:29 UTC](https://meta.discourse.org/t/issue-user-changed-google-account-and-cant-connect-thru-his-profile/35028/22 "2019-03-01T17:29:28Z")
@supermathie now that we’re [migrating all the auth providers to use the same logic](https://meta.discourse.org/t/future-social-authentication-improvements/94691), this logic will need to be refactored / removed. A lot has changed in the authentication system since 2017. The main thing is that users can connect/disconnect accounts whenever they want. As I understand it, this change was added to protect against: - User connects google account 00001, with email [user@example.com](mailto:user@example.com), to their discourse account - User tries to log into discourse using google account 00002, with email [user@example.com](mailto:user@example.com) - Error is shown, must be resolved on the console Under the new “ManagedAuthenticator”, this would happen: - User connects google account 00001, with email [user@example.com](mailto:user@example.com), to their discourse account - User tries to log into discourse using google account 00002, with email [user@example.com](mailto:user@example.com) - User logged in, reference to 00001 is scrubbed and replaced with 00002 I believe this is also the same method we follow with core [Discourse SSO](https://meta.discourse.org/t/13045?silent=true). This seems fine to me. If a user is in control of a google account with a matching email address, then we should trust them. Was there a specific attack vector you were trying to protect against with this error message, or can we go ahead and make it match the other authenticators? ---
**Author:** ![supermathie](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/supermathie/32/507518_2.png) [@supermathie](https://meta.discourse.org/u/supermathie)\ **Post date:** [2019年三月1日 19:48 UTC](https://meta.discourse.org/t/issue-user-changed-google-account-and-cant-connect-thru-his-profile/35028/23 "2019-03-01T19:48:49Z")
> [@david](#): > > Was there a specific attack vector you were trying to protect against with this error message, or can we go ahead and make it match the other authenticators? There was, see: > [@supermathie](#): > > ### This can happen when > > - the user changes their email address then logs in with a new Google account matching their new email > - the user has their Google account recreated (in a managed scenario) > - the user had their Google account deleted, but someone has created a new one matching the previous email address. **This scenario does not happen often and could potentially be malicious intent**. Wearing my paranoid hat, I felt it was best to at least make someone look into this situation when it happens. ---
**Author:** ![Bas](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/bas/32/294929_2.png) [@Bas](https://meta.discourse.org/u/Bas)\ **Post date:** [2019年三月5日 09:38 UTC](https://meta.discourse.org/t/issue-user-changed-google-account-and-cant-connect-thru-his-profile/35028/24 "2019-03-05T09:38:44Z")
> [@supermathie](#): > > the user had their Google account deleted, but someone has created a new one matching the previous email address. **This scenario does not happen often and could potentially be malicious intent**. But in that case they could just resend their password and log in that way instead of using OAuth? This change feels user-hostile, in our corporate environment, the scenario (user leaves company, email is deactivated; user is re-hired and email is re-instanced) is relatively common when we hire freelancers. ---
**Author:** ![supermathie](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/supermathie/32/507518_2.png) [@supermathie](https://meta.discourse.org/u/supermathie)\ **Post date:** [2019年三月5日 14:42 UTC](https://meta.discourse.org/t/issue-user-changed-google-account-and-cant-connect-thru-his-profile/35028/25 "2019-03-05T14:42:28Z")
> [@Bas](#): > > But in that case they could just resend their password and log in that way instead of using OAuth? Fair enough, after some thought I don’t think there’s any benefit here. What do you think @david? > [@Bas](#): > > This change feels user-hostile Prior to this change the result was “error”, functionality didn’t change. > [@Bas](#): > > email is deactivated If the email is deactivated, the Google account won’t change and you won’t run into this. Only if you delete the user. ---
**Author:** ![Bas](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/bas/32/294929_2.png) [@Bas](https://meta.discourse.org/u/Bas)\ **Post date:** [2019年三月5日 15:06 UTC](https://meta.discourse.org/t/issue-user-changed-google-account-and-cant-connect-thru-his-profile/35028/26 "2019-03-05T15:06:10Z")
> [@supermathie](#): > > > This change feels user-hostile > > Prior to this change the result was “error”, functionality didn’t change. Fair enough 😃 > [@supermathie](#): > > > email is deactivated > > If the email is deactivated, the Google account won’t change and you won’t run into this. Only if you delete the user. “Deactivated, don’t know how our IT-department implements that, might be that they delete the google account” We just encountered this yesterday and I found this recent thread, wanted to share my feedback 🙂 ---
**Author:** ![david](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/david/32/157490_2.png) [@david](https://meta.discourse.org/u/david)\ **Post date:** [2019年三月5日 15:21 UTC](https://meta.discourse.org/t/issue-user-changed-google-account-and-cant-connect-thru-his-profile/35028/27 "2019-03-05T15:21:32Z")
> [@supermathie](#): > > Fair enough, after some thought I don’t think there’s any benefit here. What do you think @david? Yeah, the protection here is certainly more ‘cautious’, but as @bas says we put so much trust in email=identity elsewhere that I think it’s fine to clean things up automatically. I’ll be migrating Google over to the new system this week so will make this change. > [@Bas](#): > > This change feels user-hostile, Also, note that @supermathie’s change was made well over a year ago - I just bumped a very old topic. Things have changed a lot in our authentication system since then. ---
**Author:** ![Bas](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/bas/32/294929_2.png) [@Bas](https://meta.discourse.org/u/Bas)\ **Post date:** [2019年三月5日 15:30 UTC](https://meta.discourse.org/t/issue-user-changed-google-account-and-cant-connect-thru-his-profile/35028/28 "2019-03-05T15:30:46Z")
> [@david](#): > > Also, note that @supermathie’s change was made well over a year ago - I just bumped a very old topic. Things have changed a lot in our authentication system since then. I did not notice that, thank you 🙂 ---
**Author:** ![system](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/system/32/443519_2.png) [@system](https://meta.discourse.org/u/system)\ **Post date:** [2022年四月13日 21:29 UTC](https://meta.discourse.org/t/issue-user-changed-google-account-and-cant-connect-thru-his-profile/35028/29 "2022-04-13T21:29:37Z")
---
**Author:** ![pfaffman](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/pfaffman/32/120154_2.png) [@pfaffman](https://meta.discourse.org/u/pfaffman)\ **Post date:** [2022年四月13日 23:37 UTC](https://meta.discourse.org/t/issue-user-changed-google-account-and-cant-connect-thru-his-profile/35028/30 "2022-04-13T23:37:24Z")
[上一頁](https://meta.discourse.org/t/issue-user-changed-google-account-and-cant-connect-thru-his-profile/35028.md?page=1)